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Quantum computers, besides offering substantial computational speedups, are also expected to 
provide the possibility of preserving the privacy of a computation. Here we show the first such 
experimental demonstration of blind quantum computation where the input, computation, and 
output all remain unknown to the computer. We exploit the conceptual framework of measurement- 
based quantum computation that enables a client to delegate a computation to a quantum server. 
We demonstrate various blind delegated computations, including one- and two-qubit gates and 
the Deutsch and Grover algorithms. Remarkably, the client only needs to be able to prepare and 
transmit individual photonic qubits. Our demonstration is crucial for future unconditionally secure 
quantum cloud computing and might become a key ingredient for real-life applications, especially 
when considering the challenges of making powerful quantum computers widely available. 



Among many quantum-enhanced applications, quan- 
tum computing has generated much interest due to the 
discovery of applications [1- 4 that outperform their best- 
known classical counterparts. Although vast technologi- 
cal developments already allow for small-scale quantum 
computers with ionic [SHS]^ photonic [9HT6], supercon- 
ducting [FT-'Sr, and solid state [22'-'2T systems, the hur- 
dles encountered in realizing quantum devices are enor- 
mous. This intrinsic technical complexity may result 
in, initially, only a few powerful quantum computers, or 
quantum servers, operating at specialized facilities. Ob- 
viously, a key challenge in using such central quantum 
computers is enabling a quantum computation on a re- 
mote server, while keeping the client's data hidden from 
the server [25ti3Q]. 

The classical analogue of this issue was addressed for 
the first time in 1978 by Rivest and co-authors [31 and 
became one of the most active fields in cryptography. A 
full solution was over 30 years in the making and en- 
ables [32' the evaluation of data-processing circuits over 
encrypted data without the need for any decryption, 
but provides only computational security. In analogy to 
many widely used cryptographic protocols, this means 
that the security relies on the assumption of a limit to 
the adversary's computational power, as well as on the 
difficulty of the underlying mathematical problem. 

Remarkably, the recent theoretical work by Broadbent, 
Fitzsimons, and Kashefi [29 overcomes this limitation 
and shows that quantum computers can provide uncon- 
ditional security in data processing — a hitherto unrecog- 
nized potential of quantum computers that is not known 
to be achievable classically. This new fundamental ad- 



vantage of quantum computers is manifested in the blind 
quantum computing (BQC) protocol that combines no- 
tions of quantum cryptography and quantum computa- 
tion to achieve the delegation of a quantum computation 
from a client with no quantum computational power to 
an untrusted quantum server, such that the client's data 
remains perfectly private. 

BQC uses the concept of one-way quantum comput- 
ing j33ti37] , a measurement-based model of computa- 
tion [38l |39] which represents a paradigm shift in the un- 
derstanding of complex data processing by clearly sepa- 
rating the classical and quantum parts of a computation. 
In the most general case, a one-way quantum computer is 
based on highly entangled multi-particle states, so-called 
cluster states, which are a resource for universal quantum 
computing. On these cluster states, adaptive single-qubit 
measurements alone are sufficient to implement deter- 
ministic universal quantum computation. Different al- 
gorithms require only a different pattern of single-qubit 
measurements on a sufficiently large cluster state. 

Therefore, a quantum computation is hidden as long 
as these measurements are successfully hidden. In or- 
der to achieve this, the BQC protocol exploits special 
resources called blind cluster states that must be cho- 
sen carefully to be a generic structure that reveals noth- 
ing about the underlying computation (see Figure [T]). 
These blind cluster states are multi-particle entangled 
states created by preparing qubits in \0j) = 1/a/2(|0) + 
e*^^|l)), where |0) and |1) are the computational basis 
of the physical qubits and Oj is chosen uniformly at ran- 
dom from {0, 7r/4, . . . , 77r/4}, and then interacting each 
qubit via controlled-phase (CPhase) gates with its near- 
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FIG. 1: The universal blind cluster state for blind quantum 
computing. This family of cluster states can be built by join- 
ing (yellow edges), for example using optical fusion opera- 
tions, smaller cluster states (purple edges, grey background) 
that are in one of the configurations of |$^) as implemented 
in the laboratory. The resulting state allows universal blind 
quantum computation when combined with measurements in 
the basis \±s),S G {0, 7r/4, . . . 77r/4}. 



est neighbours (here, CPhase|z)|j) ^ {—iy^\i)\j) with 
z,j G {0,1}). Similar to the one-way quantum com- 
puter, a blind computation is described by a pattern of 
consecutive adaptive single-qubit measurements. Mea- 
suring the first qubit, initially in state of a one- 
dimensional linear blind cluster in the basis \^s^) = 
1/V^(|0) ± e'^^\l)) has the effect of applying a single- 
qubit rotation Rz{—Si + 6>i), on the encoded input state 
|+), followed by a Hadamard, H. As long as the angle Oi 
of the rotated qubit is unknown, the real rotation remains 
secret. Here, Rz{(l)) = ex.p{—i(j)az/2), H = {ax -\-az)/V^ 
and (Tx^cTy and az denote the usual Pauli matrices. 

This feature of blind cluster states is used to perform a 
delegated computation on a server, such that all data and 
the whole computation remain hidden. The only quan- 
tum power that is required from the client is the prepara- 
tion of each qubit j in a state \0j) and the transmission of 
the qubit s to the server — in particular, there is no need 
for any quantum memory [40] or ability to perform quan- 
tum gates. From this point on in the protocol, the client 
communicates only measurement instructions and can 
be considered completely classical. The quantum server, 
which can perform universal quantum computation, per- 
forms a CPhase gate between qubits received from the 
client. Then in each round of interaction, the server per- 
forms adaptive single-qubit measurements in the \^Sj) 
basis, as instructed by the client. The measurement ba- 
sis is chosen such that Sj = + Oj + tttj , where is 
the desired target rotation and rj is a randomly chosen 
value in {0, 1} which hides the value of the measurement 
outcome. These classical measurement angles are set in 
such a way to compensate for the initial random rotation 
Oj and any other Pauli byproducts ^2 SI] produced by 
previous measurements. 



In the present work, we present a optimised version of 
the original protocol using photonic qubits. Photons are 
ideally suited for BQC as they provide the natural choice 
as quantum information carrier for the client and enable 
quantum computing for the server. This is a unique fea- 
ture of photonic systems and so far not realizable in other 
quantum systems. We experimentally demonstrate the 
concept of BQC via a series of blind computations on 
four-qubit blind cluster states. As shown in Figure [l] 
these photonic states can be combined via optical gates 
to create a universal resource state for BQC [29 . 

Our protocol uses, compared to the original BQC pro- 
posal the experimental resources in an optimised 
way, independent of the physical system and without af- 
fecting blindness. 



Optimised blind quantum computing 

It is a conceptual strength of the BQC protocol that 
perfect security can be established over a subset of com- 
putations even if not all of the qubits are unknown to the 
server. In fact, for the four-qubit blind cluster state it is 
sufficient for the client to be able to prepare only one or 
two of the qubits in arbitrary states \6j) for delegating 
various one- and two-qubit circuits as well as quantum 
algorithms, see Figure [2j This is a remarkable optimi- 
sation for the experimental requirements and is demon- 
strated for the first time here (see Appendix for theoret- 
ical details). Furthermore this optimisation is scalable 
beyond our four-qubit experimental setting and creates 
an interesting challenge on the design level to construct 
a computation such that the sensitive measurements re- 
main hidden. 

We thus fix Oi and O4 equal to zero, while varying the 
choices of 62 and 6^3. The resulting four-qubit linear blind 
cluster state is: 

1^') = ^(|+00+)i234 + e^^^|+01-)i234 (1) 
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Our experimental implementation of BQC is based 
on such a family of four-qubit linear blind cluster 
states. These are produced using photon emissions of 
a non-collinear type-II spontaneous parametric down- 
conversion process (SPDC) [10^ 42.^, as described in de- 
tail in the Appendix. If four photons are emitted into 
the output modes of the polarizing beam splitters 1, 2, 
3 and 4 (see Figure 3A), they are in a highly entangled 
state which is equivalent to the state \^^) under the local 
unitary operation H ^I^I<^ H: 
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FIG. 2: Blind circuits and corresponding measurement patterns. (A-F) We implement various types of blind computations 
using different configurations for |$^). For all implementations, 62 and 63 are blind, as has been demonstrated in the experiment. 
The angles 61 and 64 are fixed to be zero. Dependent on the experimental setting, we can implement blind linear cluster states 
1$^)-). (A) and |$^)^ (B), blind horseshoe |$^)c (C) and rotated-horseshoe cluster states (D), blind staircase cluster 

states \(f)^)j-{E) and blind triangle cluster states |$^)a(F). The measurement angle Sj, as instructed by the client, depends on 
the initial rotation of the qubit Oj (unknown to the server), the target rotation 0j and a randomly chosen value rj in {0, 1}. 



where = (712,713) and {02,0s) = (^, ^). In the ex- 
periment, we use the polarization of photons to represent 
the qubits, with |0) denoting the horizontal polarization 
state and |1) denoting the vertical polarization state. 

The client prepares the value of Oj^ which is done in 
our case by a human client. By aligning our setup to pro- 
duce l^i^'""^) forn = 0,...,7 and l^^^'"^^) for m = 0,4, 
we have demonstrated for the first time the prepara- 
tion of various four-qubit blind cluster states. Moreover, 
we have implemented 1962 different four-qubit measure- 



ments with 31392 measured outcomes. These measure- 
ments outcomes can be seen as implementing all possible 
computational branches (due to different measurement 
outcomes) , which is equivalent to directly performing the 
feed-forward mechanism [12]. However, the remarkably 
feature of the BQC protocol is that the client's privacy 
is always preserved, whether or not feed-forward mech- 
anisms have been implemented. Similarly, obtaining all 
the possible measurement outcomes is equivalent to im- 
plementing all possible values of Vj , as if the client ran- 
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domly re-interprets the measurement outcomes, implic- 
itly subsuming rj. Note that, whenever all qubits are 
measured in our setup, this method allows the client's 
choice of configuration to also be hidden from the server. 

We use an over-complete state tomography for each of 
our cluster states, in order to reconstruct the four-qubit 
density matrix. The most likely physical density matrix 
for each four-qubit state is extracted using a maximum- 
likelihood reconstruction [43l (see Figure [3^). Uncertain- 
ties in quantities extracted from these density matrices 
are calculated using a Monte Carlo routine and assumed 
Poissonian errors. Our computed fidelities for the var- 
ious blind cluster states achieve maximum values of up 
to 67.9 ± 0.4% via local unitary transformation. These 
non-ideal fidelities arise due to experimental imperfec- 
tions (see Appendix). It is important to note that ex- 
perimental infiuences on the server's side only affect the 
correctness of the computation, while imperfections in 
the client's qubit preparation might also weaken the as- 
sumption of an unbiased state distribution. 



Blind single- and two-qubit unitaries 

The four-qubit linear blind cluster |$^)^( Figure [2]) can 
be used to implement an arbitrary single-qubit unitary 
gate. Measuring qubit 1 in the eigenstates of cix^ cr^, 
or (Jz has the effect of preparing the input on qubit 2 
in the state |0), or |+), respectively, where 1+^) = 
1/a/2(|0) We are thus left with a three-qubit lin- 

ear cluster state that implements a single-qubit rotation 
gate with rotations determined by the measurements of 
the second and third qubits; this rotates the input qubit 
l^in) to the final state |^out) = Rx{-h) Rz{- (1)2) l"^ in) . 
where Rx{ol) = ex.-p{—iaax/2). By fixing 62 and vary- 
ing ^3, we can experimentally demonstrate a blind X- 
rotation. In the same way, a blind Z-rotation can be 
shown experimentally by using the four-qubit linear blind 
cluster state |<I>^)^, which has the order of measurements 
going from qubit 4 down to qubit 1 . Figure |3p depicts 
an experimental demonstration of a blind Z-rotation. By 
varying Os and averaging over all resulting density ma- 
trices, we obtain a totally mixed state with a linear en- 
tropy of 0.989 ± 0.010 that is close to the entropy of 1 
for a perfectly mixed state (see Figure [3p). As the ex- 
periments include the preparation of all eight blind clus- 
ter states 1^^^'^^), we can quantify the blindness of the 
single-qubit rotations demonstrated experimentally. The 
value of the Holevo information x (see Appendix for de- 
tails) must then be between (for perfect blindness) and 
3 (for no blindness). Using the tomographic measure- 
ments performed on these input states we determine x 
of such states to be 0.169 ± 0.074, far below the three 
bits necessary to uniquely identify the client's choice of 
02 and 03, proving that within the assumptions of our 



model these experimental implementations of the proto- 
col maintains close to perfect blindness. The above value 
of X assumes initial state is chosen uniformly at random. 
However even when this value is maximised over all possi- 
ble prior distributions on the choice of states, it increases 
only slightly to 0.185 ± 0.087. 

Two-qubit gates are required for universal quantum 
computation; by choosing the order of measurements in 
a suitable way, the blind cluster |<l>^) implements blind 
two-qubit gates (Figure |2]C-F). One family of two-qubit 
gates generated in our experiment is based on the blind 
horseshoe cluster |^^)c5 where measuring qubits 2 and 
3 of the blind cluster state performs a transformation 
on the logical input qubits (Figure ^p)- Both imple- 
mented rotations are blind and the entire computation 
remains hidden. Analyzing the output state, i.e. mea- 
suring qubits 1 and 4, delivers the result of the com- 
putation. Figure |3p shows an example of a two-qubit 
computation using the blind horseshoe cluster. Consis- 
tency with blindness can be seen by averaging over all 
output states, giving as a result a totally mixed state 
with a linear entropy of 0.955 ± 0.011. It is an in- 
teresting challenge to demonstrate the consistency with 
blindness in full generality by producing 64 blind cluster 
states. Our demonstration uses a selection of four states 
which suffices to hide the choice of rotations among four 
possibilities: Rz{7r/2 ± ir) Rz{7r/2 ± n). In a simi- 
lar way, the consistency with blindness of the rotated 
horseshoe cluster l^^*^)^ (Figure [ijl)) can be shown. We 
also realize blind computations based on the blind stair- 
case cluster |<l>^)j- (Figure [2^) and blind triangle clus- 
ter \^^)a (Figure [2^). The state \^^)a is obtained via 
local complementation [44 on qubit 2 of |^^)c- Thus 

U\^^)a \^hc where U ^/o^ ^ ^/Ox ^/o^ ^ I (with 
U acting on qubits ordered as 1,2,3,4), and measuring the 
qubits of |$^)c by absorbing the action of U into the mea- 
surements yields a computation on |^^)a as represented 
by measurement instructions S' in Figure |2^. However, 
blindness on qubit i is guaranteed only if the resulting 
measurement can be expressed as a basis We show 

in the next sections the blind staircase cluster allows for 
the blind implementation of Deutsch's algorithm, while 
the blind triangle cluster allows for the blind implemen- 
tation of Grover's algorithm. 

Blind algorithms 

One of the most prominent examples where quan- 
tum mechanics demonstrates its superiority in computa- 
tional speedup is Grover's search algorithm [3||45], which 
provides a quadratic speedup to the following problem: 
Given a function / : {0, 1}^ {0? I}? fi^d an x such that 
f{x) = 1. Here we demonstrate a blind implementation 
of Grover's search for n = 2, where blindness ensures that 
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FIG. 3: Experimental setup, measurement results (solid) and ideal values (wireframe). (A) The experimental setup to produce 
(client) and measure (quantum server) blind cluster states. The various blind cluster states are created by adjusting the settings 
of the phase retarders located along the path of the state emitted into the forward (^3) and backward {O2) modes (see Appendix 
for detailed information). (B) Density matrix of the four-qubit cluster state |$^^''^'*) in the laboratory basis. Shown are the 
real (left) and imaginary (right) parts of the density matrix. (C) Experimental demonstration of a single-qubit rotation around 
the Z-axis of the Bloch sphere and its consistency with blindness. A measurement of S4 = 7r/2, ^3 = — 7r/2, and S2 — — 7r/2 on 
the blind linear cluster results in rotations |^out) = Rx(j^) Rzi^s + 7r/2)|^in) on the encoded qubit that depend on 

the initial rotation O3. By varying O3 and averaging over all resulting density matrices, we obtain a totally mixed state. (D) 
Experimental demonstration a two-qubit gate and its consistency with blindness. Measuring ^2 = 0, and ^3 = —7v/2 at the 
states |$(^'°)), results in computations R4e2) RziOs + 7i/2) Cphase|^in) dependent on 62 and 6*3. 

Averaging over this subset of all 64 possible states results in a totally mixed state. The imaginary part of the density matrices 
(C,D) is below 0.05 and hence not shown. 



the server is unable to distinguish the actual computa- 
tion from within a given family of circuits implement- 
ing {I ^ Rz{(,)H). Whereas previous realisations p^[T2] 
are not amenable to blind implementations, our compu- 
tation, embedded into the blind triangle cluster \^^)a 
(Figure [2t') , remains blind. The algorithm proceeds as 



follows: the values of x are represented by the states 
|00), |01), 1 10) and |11), respectively. A superposition of 
all four states is initially created and the oracle tags one 
element by applying a phase of tt, thus flipping the sign 
of this term (see Figure [4]A.) . Then each of the four states 
is mapped to an output such that measuring both qubits 
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FIG. 4: Blind implementation of Grover's algorithm. (A) 
Quantum circuit. The input to the circuit is |+)|+); apply- 
ing one of the operations Rz{0 or tt) Rz{0 or 7r)CPhase de- 
fines which of the four input states |00),|01),|10),|11) is tagged 
and applies a phase shift of tt to that state. The operation 
{I^H)CPhsiSe{HRz{—7v/2)^I) then maps these four states to 
an output that is measured in the basis (l+i), \ (B) Cor- 

responding implementation on a triangle cluster |$^)a- Here, 
the measurement of qubits 2 and 3 corresponds to the tagging 
of one of the elements, measuring the output qubits 1 and 4 
with measurement angles of 7r/2 identifies then which input 
was tagged. Depending on the state we want to tag, we choose 
one set of measurement angles on qubits 2 and 3 from the four 
possible sets given in Figure [4^. For example, a measurement 
with angles — 7r/2 and tt tags the state |01). Since qubits 2 
and 3 are blind, the measurement instructions depend on the 
initial rotation of the qubit. Without that knowledge, the 
quantum server is unable to distinguish the algorithm from 
a given family of circuits. (C) Measurement outcomes for 
tagging the |01) element for all states |$*^^2,^3)^^ ^^.^ shown. 
The corresponding error bars are smaller than 0.056 for all 
results shown. 



in the basis reveals the tagged item. This compu- 
tation can be embedded into the blind triangle cluster, 
|^^)a (Figure [2^), the choice of ^2 and ^3 determines 
which element is tagged. Figure |4p shows the results of a 
Grover search for the tagging of the state |01). For each 
blind cluster state, we show the probability of identify- 
ing the tagged state as well as the probabilities of finding 
the unwanted states, due to the experimental noise. We 
achieve probabilities of finding these positive events of 
up to 0.850 ± 0.039 with an average over all blind states 
of 0.720 ± 0.015. Note that no classical algorithm can 
succeed in this scenario with probability higher than 0.5. 

Another algorithm which demonstrates the power of 
quantum computing, is the Deutsch-Josza algorithm 
that takes as input an oracle (or black-box) for comput- 
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FIG. 5: Blind implementation of Deutsch's algorithm. (A,B) 
The quantum circuits and the corresponding measurements 
on a staircase cluster state \^^)_r for the constant and the 
balanced oracle, distinguished by the measurement of qubit 2 
and qubit 3. Blindness of qubit 3 guarantees that the quan- 
tum server cannot distinguish between the execution of each 
of these scenarios (constant or balanced oracles) and corre- 
sponding families of quantum circuits. (C, D) Experimen- 
tal (solid) and theoretical (wireframe) results for a constant 
(C) and a balanced (D) oracle for the example of the state 



ing an unknown function / : {0,1}^ {^A} with the 
promise that / is either constant, meaning f{x) is the 
same for all x, or balanced, meaning f{x) = for exactly 
half of the inputs x and f{x) = 1 for the other half. The 
algorithm determines whether / is constant or balanced 
by making queries to the oracle. While the best possi- 
ble classical algorithm to solve this problem uses at least 
2n-i _^ ^ queries in the worst case, the Deutsch-Jozsa al- 
gorithm takes advantage of quantum superposition and 
interference to determine whether / is constant or bal- 
anced with only one query. In contrast to previously 
realized implementations of Deutsch's algorithm using 
traditional cluster states [16^^ |46j , we exploit blind stair- 
case cluster states for the implementation of this 
quantum algorithm for the case n = 1 . Figure |5|^ shows 
the quantum circuits that realise oracles corresponding 
to constant and balanced functions. The corresponding 
implementation on \^^)s is given in Figure [s^, where 
the choice of oracle is done by fixing the measurement on 
qubits 2 and 3. Blindness of qubit 3 guarantees that the 
quantum server will not recognize the implementation of 
a constant oracle from the Grover algorithm or general 
circuits implementing Rz{i)H^I, and a balanced oracle 
from (/ H)CV\i^^e{Rz{()H H), see Figure [s] 

Figure |5p and show the outcome of our measure- 
ment for the case of |<l>^^'^^)^. A tomography of the state 
of qubit 4 is performed in order to fully characterize the 
output of the computation. In this case, the obtained 
fidelity for the output state is F = 0.930 ± 0.025 for 
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ment instructions. Figure [6] shows relevant theoretical 
predictions as well as experimental outcomes which con- 
firm the quantum nature of the server. By instructing the 
quantum server to measure, for example, this statistical 
distribution, the client can see if the outcomes coincide 
with the expectations. Our demonstration is the first 
step towards an efficient verification scheme for quantum 
technology and acts as experimental benchmark for fu- 
ture fault-tolerant protocols using more qubits, that is 
expected to enable the detection of a cheating quantum 
server with probability exponentially close to one. 



FIG. 6: Testing of the quantum server. By measuring the 
probability distributions of a fixed measurement setting for all 
blind cluster states and comparing those with the theoretical 
expectations, the client can find out if the server possesses any 
quantum technology or not. For example, fixing the measure- 
ment settings to — — cr^, 62 = tt, (^3 = — 7r/2, and ^4 = 7r/2 
leads to different theoretical (blue) and experimental (green) 
probability distributions dependent on the underlying blind 
cluster state. A pure classical server guesses every outcome 
with the same probability (1/16) and can be detected in this 
way (red line). Conservatively, we show Poissonian errors 
which constitute a lower limit for the experimental error due 
to imperfections in the state generation (see Appendix). 

the constant oracle and F = 0.887 ± 0.033 for the bal- 
anced oracle, with the algorithm producing the correct 
result with probabilities 0.899 ± 0.006 for the constant 
and 0.895 ± 0.022 for the balanced oracle. 

Towards verifying the quant umness 

Self-testing is a verification process for the operations 
of a collection of untrusted quantum devices [47l [48] ; a 
key application of the blind computing protocol is also 
towards such verification of quantum devices [29l |30] . In 
the setting of our experiment we demonstrate a notion of 
verification that can be used as a heuristic probabilistic 
test for whether the server indeed possesses any quan- 
tum technology or is a completely classical device. For 
this, the client chooses a measurement setting for which, 
for each measurement outcome, there exists a state with 
a detection probability of zero. Due to blindness, how- 
ever, the quantum server has no information about which 
initial states the client has prepared. If it has no quan- 
tum technology in hand, it attempts to use its classical 
devices and guesses the outcome for the client's com- 
putation wrong with probability at least 1/8. Better 
bounds can be achieved using statistics of several rounds 
by comparing it with the known theoretical statistics to 
test whether the quantum-computing server is producing 
the expected outcome or not. 

We experimentally demonstrate the testing procedure 
using statistics of several outcomes for different measure- 



Discussion 

We have experimentally demonstrated the concept 
of blind quantum computing. Generating a family of 
four-qubit blind cluster states, we obtained a universal 
set of single-qubit and non-trivial two-qubit quantum 
logic gates, as well as implementations of Deutsch's and 
Grover's algorithms. We use the photon's mobility, an 
intrinsic advantage of this physical quantum system, for 
preparing various qubits on the client's side which are 
then processed by a locally separated quantum server. 

On the path from our proof-of-principle experiment to 
a full implementation of the BQC scheme, there are sev- 
eral technical challenges to be faced: Emitted photons 
that do not contribute to the generation of the clus- 
ter state can in principle reveal information about the 
blind phases. Furthermore, post-selection and photon 
losses decrease the efficiency of the protocol. There- 
fore, the realization of single-qubit states on demand 
and the heralded generation of blind cluster states us- 
ing measurement-induced interactions with high fidelity 
and low losses will be crucial for future applications. In 
our experiment, the blind angles were chosen by the hu- 
man client and the measurement settings were selected 
from a prepared list. Ideally, the source of randomness 
should be carefully scrutinized to avoid any correlations 
with the server, and an efficient shot-by-shot random- 
ization should be implemented. Considering the photon 
rates in our experiment, the realization of full random- 
ization for each measurement is a major challenge, but 
seems within reach by advancing current technologies. 
The question of how far imbalances and deviations from 
the uniform distribution can be acceptable is a topic of 
current research. 

Our experiment is the first step towards uncondition- 
ally secure quantum computing in a client-server environ- 
ment, where the client's entire computation remains hid- 
den — a functionality not known to be achievable in the 
classical world. We anticipate that this will become an 
important privacy-preserving technique in future quan- 
tum computing networks or clouds [49 . Especially con- 
sidering the tremendous challenges encountered in mak- 
ing quantum computers widely available, such future net- 
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works could consist of a few powerful quantum-computer 
nodes. The only quantum requirement for the clients 
would be to communicate with the nodes via quantum 
links enabling the transfer of arbitrary qubits. Although 
photonic quantum systems seem to be ideally suited for 
privacy-preserving quantum computing, we stress that 
our results are applicable to any physical implementation 
of qubits and that in the near future the precise quantum 
control of multi-qubit quantum systems [50] will allow for 
implementing more complex algorithms. 
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APPENDIX 
Proof of blindness for optimised BQC 

Our optimised protocol guarantees full blindness of a 
computation, even though not all qubits have an a initial 
rotation. Here, we show that algorithms that admit a 
measurement pattern in which the secret can be encoded 
over a few qubits can be made fully blind using only a few 
blind qubits. This construction works as long as measure- 
ments following the blind qubit measurements are chosen 
in the Clifford group (integer multiples of 7r/2), and thus 
our constructions works for Deutsch's and Grover's algo- 
rithms. 



In our setup, in order to achieve blindness for measure- 
ments of qubits 2 and 3 the quantum server should learn 
nothing about (/)2 and (/)3, the client's choice of measure- 
ments on those qubits. The quantum server holds the ro- 
tated qubits ^ {\0) -he'^^\l)) and ^ (|0) -|- e*^^ . it 
also has the measurement instructions (^2 = (/)2 + ^2 + 7rr2 
and ^3 = ^3 + ^3 + TTTs. For simplicity we define new 
variables O2 = O2 -\- 7rr2 and ^3 = ^3 + Trr^. Thus the 
server holds the quantum states ^ (^|0) + e'^^''^''''^^ 

and Since r2 and are ran- 

dom and unknown to the quantum server, the density 
matrices corresponding to these systems, as held by the 
server, are identically 1/2, that is, the systems are com- 
pletely mixed and thus independent of 62 and 63. As 
these angles are themselves uniformly random, the clas- 
sical information ^2 = 02 + ^2 and (^3 = 03 + ^3 is also 
uniformly random and independent of 02 and 03. Hence, 
the quantum server, despite receiving classical informa- 
tion 82 and 5s and quantum states 1^2) and 1^2), cannot 
distinguish between the possible choices of the client's 
measurements on qubits 2 and 3. Now, these blind mea- 
surements may be followed by non-blind ones. This will 
not affect the blindness (no information about 02 and 03 
will be leaked to the server) as long as the structure of 
the algorithm permits the non-blind angles to be integer 
multiples of 7r/2. This optimisation is due to the fact that 
for 04 G {0, 7r/2, TT, 37r/2}, a sign flip on (0 — 0) 
can be re-interpreted as the (possible) addition of tt to 
(0 + tt). Thus the feedforward structure for 
04 is given by the addition of an optional multiple of tt. 
This is completely hidden by the usual addition of a ran- 
dom 7rr4, included in 64. Thus, from the server's point 
of view, the process of measuring qubit 4 is independent 
of 02 and 03- 

Leakage of information in experimental blind 
quantum computing 

In order to quantify any deviation from perfect blind- 
ness introduced by experimental imperfections we need 
a model for the information received by the server dur- 
ing a run of the protocol. To this end, we assume that 
the only information obtained by the server is the ini- 
tial quantum state supplied by the client, as well as 
the classical set of angles 5i received during the proto- 
col. We also assume that the state produced by the 
experimental setup for a given choice of the ideal in- 
put state is fixed, and that the client's choices can be 
considered uniformly random. In such a model, the 
amount of information leaked is bounded by the Holevo 
information of the quantum state, p received by the 
server, x = -Tr(plog2 p) + |Tr(p^ log2 p^), where 
Pq = \{pQ + P^+tt) and pQ is the state produced in the 
experimental apparatus for the client's choice of 0. 
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Experimental setup 

In our experiment (main paper, Fig. 3A), entangled 
photon pairs are produced by exploiting the emissions of 
a non-collinear type-II SPDC process. For this, a mode- 
locked Mira HP Ti:Sa oscillator is pumped by a Coher- 
ent Inc. Verdi V-10 laser. The pulsed-laser output (r = 
200 fs, A= 789 nm, 76 MHz) is frequency-doubled using 
a 2 mm-thick Lithium triborate (LBO) crystal, resulting 
in UV pulses of 0.8 W cw average. We achieve a sta- 
ble source of UV-pulses by translating the LBO to avoid 
optical damage to the anti-reflection coating of the crys- 
tal. Afterwards, dichroic mirrors are used to separate 
the up-converted light from the infrared laser light. The 
UV beam is focused on a 2 mm-thick /3-barium borate 
(BBO) crystal cut for non-collinear type-II parametric 
down-conversion. Afterwards the beam is reflected and 
passes the crystal a second time. Entangled photon pairs 
are emitted into the forward modes, a and 6, and the 
backward modes, c and d. Half-wave plates (HWPs) and 
additional BBO crystals compensate walk-off effects and 
allow the production of any Bell state in the forward and 
backward mode. The modes of the different pairs a, c and 
6, (i, respectively, are then coherently overlapped at po- 
larizing beam splitters (PBSs) by equalizing the different 
path lengths. Narrow-band interference filters (AA = 3 
nm) are used to spatially and spectrally select the down- 
converted photons which are then coupled into single- 
mode fibers that guide them to the polarization anal- 
ysis setup. There, different polarization measurements 
are performed using quarter- wave plates (QWPs), HWPs 
and polarizing beam splitters. 

Experimental preparation of blind cluster states 

The blind cluster state in the laboratory basis is com- 
posed of four terms that correspond to different emis- 
sions of four photons. Such four-photon emissions can 
experimentally be obtained either by an emission of two 
entangled pairs, one in the forward and one in the back- 
ward mode, or by double-pair emissions into the forward 
or the backward mode. The production of our clus- 
ter state exploits coherent superpositions of these dif- 
ferent four-pair contributions and utilizes the properties 
of the polarising beam splitters (PBSs) as well as post- 
selection to obtain the appropriate state. In order to 
produce the desired state, we align our setup such that 
a 1^^^) = {\HH) - e'^^\VV))/V2 state is emitted in the 
forward direction and a |$+ ) = {\HH) + e'^^\VV))/V2 
state in the backward direction, where \H) {\V)) denotes 
the horizontal (vertical) polarization state. The emis- 



sion of only one entangled pair in the forward direction 
and only one pair in the backward direction results in 
two different four-photon terms: \H)i\H)2\H)s\H)4 and 
-e'^^^^^^^\V)i\V)2\V)3\V)4. due to the properties of the 
PBSs. The two-pair emissions also lead to fourfold coin- 
cidences, namely to a — e*^^ |^)i|^)2|V^)3|'^)4 state and a 
e'^^'^\V)i\V)2\H)s\H)4 state for a double-pair emission in 
the forward and in the backward direction, respectively. 
We shift the phase of the term -e'^^\H)i\H)2\V)s\V)4 
by TT to generate a sign shift. For this, we use the 
method [10 where a rotation of an additional wave plate 
has the desired effect. The final output state is a super- 
position of all these four terms. In our setup we use a 
combination of quarter-wave plates and half-wave plates 
to adapt the phase of the state that is emitted into the 
forward mode. The phase of the backward pair is adapted 
by tilting one of the compensation crystals. Note that 
after the PBS two quarter-wave plates are inserted in 
modes 3 and 4 to compensate for birefringence effects. 
By changing the phases of the entangled pairs, we can 
now manipulate the values of O2 and Os of the client's 
qubits. 

In our experiment, the emitted Bell pairs show a typ- 
ical visibility of about 0.9, depending on the specific ex- 
perimental setting. The different photon emissions then 
interfere at the PBSs with average visibilities of 0.85. 
Additional errors arise due to phase drifts during the 
measurements. These main error contributions, together 
with minor errors like polarisation drifts, decrease the fi- 
delity of our blind cluster states with respect to the ideal 
state. In our calculations, we always assume Poissonian 
errors. In fact, these indicate a lower bound for the ac- 
tual error that takes all the experimental imperfections 
into account. This is underlined by an analysis of the 
data of Figure 6 (main paper) where we obtain a value 
of of 1-6 when assuming Poissonian errors only. In- 
cluding the errors mentioned above, we obtain a value 
satisfactorily close to one (about 1.1). 

In the context of BQC, the client has access to the 
various four-photon emissions and prepares the encoded 
phases, for example O2 and ^3, by applying local opera- 
tions. These photons are then sent to the quantum server 
who generates entangled blind cluster states by superim- 
posing these qubits on two polarizing beam splitters, fol- 
lowed by a successful detection of a four-fold coincidence 
in the output modes 1-4. The settings for the compu- 
tation are set by phase retarders in each of the output 
modes to align the setting for the consecutive projective 
measurements. We note that due to the down-conversion 
process the client rather prepares arbitrarily rotated Bell 
pairs instead of single qubits, which enables a compact 
client-server network without affecting the blindness. 



